Dependency Scanning — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— Dependency Scanning
📋Generate SBOM
⚠️CVE Scan
🩺Triage
🔧Patch
🎯 Next: Test →
Step 1 / 4
Speed
Generate CycloneDX SBOM
Build Software Bill of Materials💡 Analogy
Like an ingredient list on packaged food — mandated so consumers (and regulators) know exactly what's inside.
The SBOM lists every library in the application — direct and transitive — with exact versions and licence information.
Console Output
> CycloneDX SBOM generation...
> Analysing: MyApp.csproj + 847 transitive dependencies
> bom.xml generated:
>   Components: 847
>   Direct dependencies: 23
>   Transitive: 824
>   Licences: MIT(412), Apache-2.0(289), BSD-3(146)
> Uploaded as artifact: sbom-cyclonedx
●.github/workflows/deps.yml
Generate CycloneDX SBOML47–58
1# Dependency Scanning Pipeline — .NET + npm + SBOM
2# .github/workflows/deps.yml
3 
4name: Dependency Security
5 
6on:
7  schedule:
8    - cron: '0 6 * * 1'  # Weekly Monday 6am
9  push:
10    paths:
11      - '**/*.csproj'
12      - 'package*.json'
13      - 'requirements.txt'
14 
15jobs:
16  dotnet-deps:
17    name: .NET Vulnerability Scan
18    runs-on: ubuntu-latest
19    steps:
20      - uses: actions/checkout@v4
21      - uses: actions/setup-dotnet@v4
22        with:
23          dotnet-version: '9.x'
24 
25      - name: Check vulnerable packages
26        run: |
27          dotnet list package --vulnerable --include-transitive 2>&1 | tee vuln-report.txt
28          # Exit 1 if any critical/high CVEs found
29          if grep -q "Critical|High" vuln-report.txt; then
30            echo "::error::Critical or High CVEs found!"
31            exit 1
32          fi
33 
34  npm-deps:
35    name: npm Audit
36    runs-on: ubuntu-latest
37    steps:
38      - uses: actions/checkout@v4
39      - run: npm ci
40 
41      - name: npm audit (fail on high+)
42        run: npm audit --audit-level=high
43 
44      - name: Snyk SCA with reachability
45        uses: snyk/actions/node@master
46        env:
47          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
48        with:
49          args: --severity-threshold=high --reachability
50 
51  sbom:
52    name: Generate SBOM
53    runs-on: ubuntu-latest
54    steps:
55      - uses: actions/checkout@v4
56 
57      - name: Generate CycloneDX SBOM
58        uses: CycloneDX/gh-dotnet-generate-sbom@v1
59        with:
60          path: ./src/MyApp.csproj
61          github-bearer-token: ${{ secrets.GITHUB_TOKEN }}
62 
63      - name: Upload SBOM artifact
64        uses: actions/upload-artifact@v4
65        with:
66          name: sbom-cyclonedx
67          path: bom.xml
68          retention-days: 90   # Compliance retention
69 
69 lines
Timeline — 4 Steps
Generate CycloneDX SBOM
Build Software Bill of Materials💡 Analogy
Like an ingredient list on packaged food — mandated so consumers (and regulators) know exactly what's inside.
The SBOM lists every library in the application — direct and transitive — with exact versions and licence information.
Console Output
> CycloneDX SBOM generation...
> Analysing: MyApp.csproj + 847 transitive dependencies
> bom.xml generated:
>   Components: 847
>   Direct dependencies: 23
>   Transitive: 824
>   Licences: MIT(412), Apache-2.0(289), BSD-3(146)
> Uploaded as artifact: sbom-cyclonedx

Was this page helpful?

Discussion

Build Software Bill of Materials

💡 Analogy

Like an ingredient list on packaged food — mandated so consumers (and regulators) know exactly what's inside.

The SBOM lists every library in the application — direct and transitive — with exact versions and licence information.

Console Output

> CycloneDX SBOM generation...
> Analysing: MyApp.csproj + 847 transitive dependencies
> bom.xml generated:
>   Components: 847
>   Direct dependencies: 23
>   Transitive: 824
>   Licences: MIT(412), Apache-2.0(289), BSD-3(146)
> Uploaded as artifact: sbom-cyclonedx

Build Software Bill of Materials

💡 Analogy

Like an ingredient list on packaged food — mandated so consumers (and regulators) know exactly what's inside.

The SBOM lists every library in the application — direct and transitive — with exact versions and licence information.

Console Output

> CycloneDX SBOM generation...
> Analysing: MyApp.csproj + 847 transitive dependencies
> bom.xml generated:
>   Components: 847
>   Direct dependencies: 23
>   Transitive: 824
>   Licences: MIT(412), Apache-2.0(289), BSD-3(146)
> Uploaded as artifact: sbom-cyclonedx